# Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer?

1. Encrypt the plaintext and compare against the ciphertext, or
2. Decrypt the ciphertext and compare against the plaintext in $O(n)$

The former appears better to me since the contents of the ciphertext are never decrypted and loaded into memory. However, given that it's an authenticated mode of encryption, this bypasses the authentication checks that would normally occur during decryption.

So, which is hypothetically worse? Potentially allowing Eve to load decrypted ciphertexts into memory, or potentially allowing Eve to force my system into comparing plaintexts (either under Eve's control or unknown to her) to forged ciphertexts?

-

2 is considered better, because the probability of the comparison in 1 returning $\:\text{true}\:$ is always at most $$\frac1{2^{\operatorname{len}(\text{IV})}}$$

-
What would the probability of the comparison returning $true$ be on the second one? Would it be \$1 / 2^{len(ciphertext)}, since given a fixed IV, key, and plaintext, there should be one possible ciphertext? –  Stephen Touset Dec 4 '12 at 22:37
Note that in method 1, one can reuse the IV that's included with the ciphertext. If you do that, it succeeds with probability 1. This doesn't answer the question; however, it does mean that both options are viable. –  poncho Dec 4 '12 at 22:55
Can you elaborate, poncho? I'm not sure I understand. –  Stephen Touset Dec 5 '12 at 0:15
@StephenTouset: the encryption process of an authenticated mode takes an IV, which is sent along with the ciphertext (as it is required for decryption). Hence, in method 1, when you re-encrypt the candidate plaintext, you can use the IV included with the ciphertext; this would make the encryption procedure determanistic. Note that this would not necessarily bypass the authenticate check; the authentication tag generated during the encryption should make the authenticate tag included with the ciphertext –  poncho Dec 5 '12 at 0:31
In this case, the user of the high-level API has to provide their own IV along with the ciphertext. –  Stephen Touset Dec 5 '12 at 1:42